diff --git a/ChangeLog b/ChangeLog
index 3fb3a3c523..8c35ea54df 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+Fri Jul  1 17:55:08 2005  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* bignum.c (rb_big_neg): may be accessing bogus pointer value.
+
 Fri Jul  1 15:50:12 2005  NAKAMURA Usaku  <usa@ruby-lang.org>
 
 	* missing/erf.c: need to include some headers for some platforms.
diff --git a/LEGAL b/LEGAL
index 80c3c8852d..8fa296ee74 100644
--- a/LEGAL
+++ b/LEGAL
@@ -127,14 +127,12 @@ st.[ch]:
 x68/*:
 missing/alloca.c:
 missing/dup2.c:
-missing/erf.c:
 missing/finite.c:
 missing/hypot.c:
 missing/isinf.c:
 missing/isnan.c:
 missing/memcmp.c:
 missing/memmove.c:
-missing/mkdir.c:
 missing/strcasecmp.c:
 missing/strchr.c:
 missing/streror.c:
@@ -179,6 +177,8 @@ missing/strtoul.c:
     software for any purpose.  It is provided "as is" without
     express or implied warranty.
 
+missing/erf.c:
+missing/crypt.c:
 missing/vsnprintf.c:
 
   This file is under the old-style BSD license.  Note that the
@@ -198,11 +198,7 @@ missing/vsnprintf.c:
     2. Redistributions in binary form must reproduce the above copyright
        notice, this list of conditions and the following disclaimer in the
        documentation and/or other materials provided with the distribution.
-    3. All advertising materials mentioning features or use of this software
-       must display the following acknowledgement:
-         This product includes software developed by the University of
-         California, Berkeley and its contributors.
-    4. Neither the name of the University nor the names of its contributors
+    3. Neither the name of the University nor the names of its contributors
        may be used to endorse or promote products derived from this software
        without specific prior written permission.
 
diff --git a/bignum.c b/bignum.c
index f1d26ffd8a..c5154dbe13 100644
--- a/bignum.c
+++ b/bignum.c
@@ -1055,10 +1055,12 @@ rb_big_neg(x)
     VALUE x;
 {
     VALUE z = rb_big_clone(x);
-    BDIGIT *ds = BDIGITS(z);
-    long i = RBIGNUM(x)->len;
+    BDIGIT *ds;
+    long i;
 
     if (!RBIGNUM(x)->sign) get2comp(z);
+    ds = BDIGITS(z);
+    i = RBIGNUM(x)->len;
     while (i--) {
 	ds[i] = ~ds[i];
     }